Provide internal TLS certificates with cert-manager

Use cert-manager to automate certificate issuance and renewal for internal mutual TLS (mTLS) instead of generating certificates manually with OpenSSL.

Before you begin

You have cluster administrator access to the OpenShift namespace where automation orchestrator is deployed.
You have installed and authenticated the oc CLI.
cert-manager is installed on the cluster.
You have a configured Issuer or ClusterIssuer resource that can issue certificates.
You have reviewed the certificate requirements in Provide your own internal TLS certificates.

Procedure

Create a Certificate resource for each of the five services (backend, worker, background worker, temporal, UI).

For the complete YAML specification of each Certificate resource, see cert-manager Certificate resources for automation orchestrator.

cert-manager creates the corresponding kubernetes.io/tls Secrets automatically.
Create a Secret for the CA certificate used by your Issuer:
```
apiVersion: v1
kind: Secret
metadata:
  name: ao-internal-ca
  namespace: automation-orchestrator
type: Opaque
data:
  ca.crt: base64-encoded-CA-certificate
```
If your Issuer uses a ClusterIssuer with a well-known CA, export the CA certificate from the Issuer's Secret.
Reference the Secrets in the spec.tls section of the AutomationOrchestrator custom resource.

Use the Secret names from your Certificate resources. For the required spec.tls fields, see Internal TLS.
Apply or update the custom resource:
```
$ oc apply -f automation-orchestrator.yaml
```
cert-manager handles certificate renewal automatically. When cert-manager renews a certificate, the operator detects the Secret change and triggers a rolling restart of the affected pods.

cert-manager Certificate resources for automation orchestrator

Use the following Certificate resource definitions when you configure cert-manager to manage internal mutual TLS (mTLS) certificates for automation orchestrator.

The operator names each service as cr-name-component, where cr-name is the metadata.name of your AutomationOrchestrator custom resource. The following examples use my-orchestrator as the custom resource (CR) name and automation-orchestrator as the namespace. Replace these values to match your deployment.

Backend

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ao-backend-tls
  namespace: automation-orchestrator
spec:
  secretName: ao-backend-tls
  issuerRef:
    name: your-issuer
    kind: Issuer
  usages:
    - server auth
    - client auth
  commonName: backend.ao.svc
  dnsNames:
    - my-orchestrator-backend
    - my-orchestrator-backend.automation-orchestrator.svc
    - my-orchestrator-backend.automation-orchestrator.svc.cluster.local
    - localhost
  ipAddresses:
    - 127.0.0.1

Worker

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ao-worker-tls
  namespace: automation-orchestrator
spec:
  secretName: ao-worker-tls
  issuerRef:
    name: your-issuer
    kind: Issuer
  usages:
    - server auth
    - client auth
  commonName: worker.ao.svc
  dnsNames:
    - my-orchestrator-worker
    - my-orchestrator-worker.automation-orchestrator.svc
    - my-orchestrator-worker.automation-orchestrator.svc.cluster.local
    - localhost
  ipAddresses:
    - 127.0.0.1

Background worker

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ao-background-worker-tls
  namespace: automation-orchestrator
spec:
  secretName: ao-background-worker-tls
  issuerRef:
    name: your-issuer
    kind: Issuer
  usages:
    - server auth
    - client auth
  commonName: background-worker.ao.svc
  dnsNames:
    - my-orchestrator-background-worker
    - my-orchestrator-background-worker.automation-orchestrator.svc
    - my-orchestrator-background-worker.automation-orchestrator.svc.cluster.local
    - localhost
  ipAddresses:
    - 127.0.0.1

Temporal

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ao-temporal-tls
  namespace: automation-orchestrator
spec:
  secretName: ao-temporal-tls
  issuerRef:
    name: your-issuer
    kind: Issuer
  usages:
    - server auth
    - client auth
  commonName: temporal.ao.svc
  dnsNames:
    - my-orchestrator-temporal
    - my-orchestrator-temporal.automation-orchestrator.svc
    - my-orchestrator-temporal.automation-orchestrator.svc.cluster.local
    - localhost
  ipAddresses:
    - 127.0.0.1

UI

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ao-ui-tls
  namespace: automation-orchestrator
spec:
  secretName: ao-ui-tls
  issuerRef:
    name: your-issuer
    kind: Issuer
  usages:
    - server auth
    - client auth
  commonName: ui.ao.svc
  dnsNames:
    - my-orchestrator-ui
    - my-orchestrator-ui.automation-orchestrator.svc
    - my-orchestrator-ui.automation-orchestrator.svc.cluster.local
    - localhost
  ipAddresses:
    - 127.0.0.1